CVE-2026-22727: Missing Authentication for Critical Function

Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has bypassed the firewall to potentially replace droplets and therefore applications allowing them to access secure application information...

Cloud Foundry CAPI 信任管理问题漏洞

Cloud Foundry CAPI is a cloud controller from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry CAPI versions 1.140 through 1.152.0, Loggregator-agent v7+, and CF Deployment versions 24.7.0 through 29.0.0, which originates in Cloud foundry instanc...

CVE-2021-22100: Uncontrolled Resource Consumption

In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that accidentally or maliciously causes CC instances to timeout and fail is possible. An attacker can leverage this vulnerability to cause an inability for anyone to push or...

CVE-2020-5418 Cloud Controller allows users with no roles to list droplets

Cloud Foundry CAPI Cloud Controller versions prior to 1.98.0 allow authenticated users having only the "cloudcontroller.read" scope, but no roles in any spaces, to list all droplets in all spaces whereas they should see none...

CVE-2020-5418: Incorrect Authorization

Cloud Foundry CAPI Cloud Controller versions prior to 1.98.0 allow authenticated users having only the "cloudcontroller.read" scope, but no roles in any spaces, to list all droplets in all spaces whereas they should see none...

CVE-2020-5418

Cloud Foundry CAPI Cloud Controller versions prior to 1.98.0 allow authenticated users having only the "cloudcontroller.read" scope, but no roles in any spaces, to list all droplets in all spaces whereas they should see none...

CVE-2020-5417

Cloud Foundry CAPI Cloud Controller, versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain which is true in the default CF Deployment manifest, were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially...

CVE-2020-5417: Incorrect Permission Assignment for Critical Resource

Cloud Foundry CAPI Cloud Controller, versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain which is true in the default CF Deployment manifest, were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially...

CVE-2020-5417: Cloud Controller may allow developers to claim sensitive routes | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry CAPI Cloud Controller, versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain which is true in the default CF Deployment manifest, is vulnerable to developers maliciously or...

CVE-2019-11294: CAPI leaks service broker URLs and GUIDs to space developers | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Description Cloud Foundry Cloud Controller API CAPI, version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins. Affected Cloud Foundry Products and...